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CBA 

A=I_SYNACK (black) 
B=P_SYNACK (red) 
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DASH=send {C_1ACK) 
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One connection in detail 



Client - PG conversadon 
35.307723 client.2894 > PG.80: S 649812829:649812829(0) win 8192 id 37968 
<mss 536> 

35.307807 PG.80 > client.2894: S 2103996938:2103996938(0) ack 649812830 

win 32736 id 22893 <mss 536> 
35394877 client.2S94 > PG.80: . ack 1 win 8576 id 37989 
35.402592 client.2894 > PG.80: P 1:405(404) ack 1 win 8576 id 37991 
35.404046 PG.80 > ciient.2894: P 1:160(159) ack 405 win 32736 id 22902 
35,404327 PG.80 > client.2894: F 160: 160(0) ack 405 win 32736 id 22903 
35.499080 client,2894 > PG.80: . ack 161 win 8417 id 38023 
35.598546 client.2894 > PG.80: F 405:405(0) ack 161 win 8576 id 38049 
35.598617 PG,80 > client.2894: . ack 406 win 32735 id 22925 
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W/IG: connection open 



35.307723 client.2894 > PG.80: S 649812829:649812829(0) win 8192 id 37968 
<mss 536> 

EWS duplicates client open 

35.307864 client-2894 > IG.80: S 649812829:649812829(0) win 8192 id 37968 
<mss 536> (ews) 

35307807 PG.80 > client.2894: S 2103996938:2103996938(0) ack 649812830 
win 32736 id 22893 <mss 536> 

Invisible Ghost responds to open 

35.308005 IG.80 > client2894: S 1396028487:1396028487(0) ack 649812830 
win 32736 id 44202 <mss 536> 



35.394877 client2894 > PG.80: . ack 1 win 8576 id 37989 

EWS duplicates client first ack, adjusting sequence numbers 
35.394940 client.2894 > IG.80: . ack 1 wm 8576 id 3750 (ews) 

35.402592 client.2894 > PG.80: P 1:405(404) ack 1 win 8576 id 37991 

EWS duplicates client request 

35.402723 client.2894 > IG.80: P 1 405(404) ack 1 win 8576 id 37991 (ews) 
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W/IG: ack and request 
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W/IG: Ghost responses 



Invisible Ghost responds with 196 bytes 

35.404068 IG.80 > client.2894: P 1:197(196) ack 405 win 32736 id 44209 
Production Ghost with 159 bytes 

35.404046 PG.80 > client.2894: P 1:160(159) ack 405 win 32736 id 22902 
PG closes connection 

35.404327 PG.80 > client.2894: F 160:160(0) ack 405 win 32736 id 22903 
IG closes connection 

35.404457 IG.80 > client.2894: F 197:197(0) ack 405 win 32736 id 44210 



Client acknowledges data & FIN 

35.499080 client.2894 > PG.80: . ack 161 win 8417 id 38023 

EWS ack's data (rounding to packet boundary) 

35.499146 client.2894 > IG.80: . ack 197 win 8381 id 3776 (ews) 

EWS ack's FIN (blowing window open for drain) 

35.540786 client.2894 > IG.80: . ack 198 win 65533 id 3778 (ews) 
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W/IG: Ack generation 
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W/IG: Connection Close 



35.598546 client.2894 > PG.80: F 405:405(0) ack 161 win 8576 id 38049 
35.598604 client.2894 > IG.80: F 405:405(0) ack 198 win 8576 id 38049 (ews) 
35.598617 PG.80 > client.2894: . ack 406 win 32735 id 22925 
35.598754 IG.80 > client.2894: . ack 406 win 32735 id 44216 



[[cmp -;idrt Wed Jan 12 04 44 14 2000 ]] 

(u (38 i6S 66 2 1283) headers (request I)] 

GET /?/ I508/993/382b7678/www loc*smart.com/t/ls99/ls-cats gtf HTTPJl 0 
Accept */* 

Rererer hup //www look-imart com/eus l/eus65300/eus653O3/eus77S24/eus65O79/eus327765yeus327766/eus3 l&903/eas3 1 36 10/r >l& 
Accept-Umguage en-us 
Accept -En coding gzip, deflate 

User- Agent Mozilla/4 0 (compatible, MSIE 4 01, Windows 95) 
Host al 508 g akamaitech net 
tpg (38 187 87 201 80) headers (I) lotal^bytes 1982 body_bytes 1735] 
HTTP/ 1 0 200 OK 

Ddle Fn, 12 Nov 1999 01 57 01 GMT 

Server Apuche/l 3 4 (Umx) 

Last^Modified Mon. 09 Aug 1999 22 03 59 GMT 

ETag "a9c71-6c7-37af504r 

Accept-Ranges b>ies 

Contenl-Length 1735 

Contenl-Type image/gif 

ConnectiOT close 

[ig (38 185 125 201 80) headers (l)total_b>tes 1903 body_b>tes 1656] 
HTTP/ 1 0 200 OK. 

Date Wed, l2Jan 200002 15 14GMT 
Server Apache/ 1 3 4 (Unix) 
Last-Modified Wed, 11 Aug 1999 20 02 14 GMT 
ETag "7a939-678-37bld6c6" 
Accepl-Ranges bytes 
Content-Length 1636 
Content-Type image/gjf 
Connection ciose 
fmsg] Diftering reiipon-ie lengths 
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Compartor Report 



[|cmp end]] 
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